TheHive Node: Getting the specific error from the node


I am currently checking if some alert is on hive before inserting. Don’t ask why, i need to do it :slight_smile:

The problem is that sometimes there are some errors triggered by the API: 404 if alert not found or some other error code (e.g. deadlock). There are also cases where i just get no error code (e.g. connection refused).

I need to handle this errors somehow. However, it seems that when thehive has an error it returns nothing to the next module so i have no idea what to do.

Anyone able to help me with this?


Welcome to the community @bmb

By default, if an error happens, the execution stops. To be able to continue executing even when errors happen, you need to enable continue on fail in the setting tabs. With that, you are going to be able to process the errors later in the workflow.

Hi @RicardoE105

Thanks for prompt response. I am aware but how can i read the error on the next node? Which expression can i use?


Hey @bmb,

This option will continue your workflow and process the next incoming item (in your case it will listen for the next call). If you want to add a check, you can add an IF node and use the Is Empty operation. Since there won’t be any data for the Error, the IF node will true. If there was no error, the IF node will receive data, and the condition will be false. Connect the next nodes to the false output of the IF node to proceed forward. Let me know if you need more details.

Thanks for response @harshil1712 . What is this “Is Empty” operation? Can you write the code here, please?


Hey @bmb,

I’ve added a screenshot for your reference. You can use the “Is Empty” operation in the IF node.

Hi @harshil1712 and then i reference the output from the previous module? E.g.:

{{‘createdBy’ in $node[“TheHiveCreateAlert(twistlock-unexpected-listening-port-heuristic)”].json}}

I am doing a similar check now but this does not allow granular checking on the error. I may want to act in some way if the alert does not exist or if there was a connection refused.

If you want to check for workflow errors, you should use the Error Trigger node.